fix(cra-kit): review findings on sbom scripts

cra-kit/scripts/_cra-sbom-extract.sh

@@ -240,7 +240,7 @@ PYEOF
         fi
         jq -r '.[].file' "$CRA_SBOM_BUILD_DIR/compile_commands.json" \
             | grep -F "$_cra_product_dir/" \
-            | grep -E '\.c$' \
+            | grep -E '/(wolfcrypt/src|src)/[^/]+\.c$' \
             | sort -u > "$_cra_out_file" || true
         if [ ! -s "$_cra_out_file" ]; then
             echo "ERROR: compile_commands.json in $CRA_SBOM_BUILD_DIR yielded no $_cra_product_name sources under $_cra_product_dir." >&2

cra-kit/scripts/generate-wolfhsm-sbom.sh

@@ -62,8 +62,11 @@ if [ ! -f "$GEN" ]; then
     exit 1
 fi
 
-# Parse version from ChangeLog.md: first line matching "## wolfHSM Release vX.Y.Z"
-VERSION=$(sed -n 's/^# wolfHSM Release v\([0-9][0-9.]*\).*/\1/p' \
+# Parse version from ChangeLog.md: first heading matching "wolfHSM Release vX.Y.Z".
+# Current ChangeLog.md uses an H1 ("# wolfHSM Release v1.4.0"); tolerate one or
+# two leading '#', surrounding whitespace, and an optional 'v' so a changelog
+# style change does not silently break the parse.
+VERSION=$(sed -n 's/^#\{1,2\}[[:space:]]*wolfHSM Release[[:space:]]*v\{0,1\}\([0-9][0-9.]*\).*/\1/p' \
     "$WOLFHSM_DIR/ChangeLog.md" 2>/dev/null | head -1)
 if [ -z "$VERSION" ]; then
     echo "ERROR: could not parse version from $WOLFHSM_DIR/ChangeLog.md." >&2

cra-kit/scripts/generate-wolfmqtt-sbom.sh

@@ -137,6 +137,16 @@ _run_autotools() {
         else
             make sbom WOLFSSL_DIR="$WOLFSSL_DIR"
         fi
+        # make sbom names artifacts after configure.ac's PACKAGE_VERSION; if
+        # that ever skews from wolfmqtt/version.h (our $VERSION), fail with an
+        # explanation instead of a cryptic cp "No such file" under set -eu.
+        if [ ! -f "wolfmqtt-${VERSION}.cdx.json" ]; then
+            echo "ERROR: make sbom did not produce wolfmqtt-${VERSION}.cdx.json." >&2
+            echo "       wolfmqtt/version.h says $VERSION but the autotools" >&2
+            echo "       PACKAGE_VERSION (which names make sbom outputs) differs:" >&2
+            ls wolfmqtt-*.cdx.json >&2 2>/dev/null || true
+            exit 1
+        fi
         cp -f "wolfmqtt-${VERSION}.cdx.json" "$CDX_OUT"
         cp -f "wolfmqtt-${VERSION}.spdx.json" "$SPDX_OUT"
         if [ -f "wolfmqtt-${VERSION}.spdx" ]; then

cra-kit/user_settings.h

@@ -1,4 +1,5 @@
 /* Demo user_settings.h for CRA Kit embedded SBOM generation.
+ * Illustrative only, NOT a security-hardened production configuration.
  * Production: replace with your project's user_settings.h (or point gen-sbom at it). */
 #ifndef CRA_KIT_USER_SETTINGS_H
 #define CRA_KIT_USER_SETTINGS_H